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1 LA method for securing an accessible computer system, the method 

2 comprising: 

3 receiving a data packet that includes a payload portion and an attribute portion and is 

4 communicated between at least one access requestor and at least one access provider; 

5 monitoring at least the payload portion of the data packet received by scanning the 

6 payload portion for at least one predetermined pattern; and 

7 controlling access by the access requestor to the access provider when the payload 

8 portion is determined to include at least one predetermined pattern. 

1 2. The method as in claim 1 wherein: 

2 receiving the data packet includes receiving more than one data packet; and 

3 monitoring the data packet includes counting the number of data packets having 

4 payload portions that include the predetermined pattern. 

1 3. The method as in claim 1 wherein monitoring the data packet includes 

2 scanning the payload portion while handling the data packet with a switch. 

1 4. The method as in claim 3 wherein: 

2 receiving the data packet incl tides receiving more than one data packet; and 

3 monitoring the data packet includes monitoring only at least one data packet that is 

4 distinguished. 

1 5. The method as in claim 1 wherein: 

2 receiving the data packet includes receiving more than one data packet, 

3 securing the accessible computer system further comprises distinguishing at least one 

4 of the data packets from among the data packets received for additional processing, and 

5 monitoring the payload portion includes monitoring the payload portion of the at least 

6 one data packet distinguished. 

1 6. The method as in claim 5 wherein the at least one data packet is distinguished 

2 based on an Internet address associated with the data packet. 
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1 7. The method as in claim 1 wherein: 

2 receiving the data packet includes receiving more than one data packet; and 

3 monitoring the data packet includes monitoring all of the data packets received. 

1 8, The method as in claim 1 wherein the access requestor is a client and the 

2 access provider is a host. 

1 9. The method as in claim 8 wherein the data packet is monitored when 

2 communicated from the client to the host. 

1 10. The method as in claim 8 wherein the data packet is monitored when 

2 communicated from the host to the client. 

1 11. The method as in claim 8 wherein the predetermined pattern includes a login 

2 failure message communicated from the host to the client. 

1 12. The method as in claim 1 wherein the data packet includes a token-based 

2 protocol packet. 

1 13. The method as in claim 1 wherein the data packet includes a TCP packet. 

1 14. The method as in claim 1 wherein the data packet includes a PPP packet. 

1 15. The method as in claim 1 wherein controlling access includes denying access 

2 by the access requestor to the access provider. 

1 1 6. The method as in claim 1 wherein controlling access includes affecting 

2 bandwidth for communications between the access requestor and the access provider. 

1 17. The method as in claim 1 wherein controlling access includes rerouting the 

2 access requestor. 
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1 18. The method as in claim 2 wherein: 

2 receiving the data packet includes receiving more than one data packet; and 

3 controlling access by the access requestor to the access provider includes denying 

4 access by the access requestor to the access provider when a number of payload portions that 

5 include the predetermined pattern exceed a configurable threshold number. 

1 19. The method as in claim 1 8 wherein controlling access by the access requestor 

2 to the access provider includes denying access by the access requestor to the access provider 

3 when a number of payload portions that include the predetermined pattern exceed a 

4 configurable threshold number during a configurable period of time. 

1 20. A system for securing an accessible computer system, comprising: 

2 a receiving component that is structured and arranged to receive a data packet that 

J 3 includes a payload portion and an attribute portion and is communicated between at least one 

m 4 access requestor and at least one access provider; 

Jg 5 a monitoring component that is structured and arranged to monitor at least the 

2* 6 payload portion of the data packet received and includes a scanning component that is 

w 7 structured and arranged to scan the payload portion for at least one predetermined pattern; 

□ 8 and 

% I 9 an access controlling component that is structured and arranged to control access by 

Cl 10 the access requestor to the access provider when the payload portion is determined to include 

El 1 1 at least one predetermined pattern. 

1 21 . The system of claim 20 wherein: 

2 the receiving component is structured and arranged to receive more than one data 

3 packet; and 

4 the monitoring component further includes a counting component that is structured 

5 and arranged to count the number of data packets having payload portions that include the 

6 predetermined pattern. 

1 22. The system of claim 20 wherein the monitoring component includes a 

2 scanning component that is structured and arranged to scan the payload portion while 

3 handling the data packet with a switch. 
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1 23 . The system of claim 22 wherein: 

2 the receiving component is structured and arranged to receive more than one data 

3 packet; and 

4 the monitoring component is structured and arranged to monitor only at least one data 

5 packet that is distinguished. 

1 24. The system of claim 20 wherein: 

2 the receiving component is structured and arranged to receive more than one data 

3 packet, 

4 the system further comprises a distinguishing component that is structured and 

5 arranged to distinguish at least one of the data packets from among the data packets received 

6 for additional processing, and 

7 the monitoring component is structured and arranged to monitor the payload portion 

8 of the at least one data packet distinguished. 

1 25. The system of claim 24 wherein the at least one data packet is distinguished 

2 based on an Internet address associated with the data packet. 

1 26. The system of claim 20 wherein: 

2 the receiving component is structured and arranged to receive more than one data 

3 packet; and 

4 the monitoring component is structured and arranged to monitor all of the data 

5 packets received. 

1 27. The system of claim 20 wherein the access requestor is a client and the access 

2 provider is a host. 

1 28. The system of claim 27 wherein the data packet is monitored when 

2 communicated from the client to the host. 

1 29. The system of claim 27 wherein the data packet is monitored when 

2 communicated from the host to the client. 
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1 30. The system of claim 27 wherein the predetermined pattern includes a login 

2 failure message communicated from the host to the client. 

1 3 1 . The system of claim 20 wherein the data packet includes a token-based 

2 protocol packet. 

1 32. The system of claim 20 wherein the data packet includes a TCP packet. 

1 33. The system of claim 20 wherein the data packet includes a PPP packet. 

1 34. The method as in claim 20 wherein the access controlling component is 

2 structured and arranged to deny access by the access requestor to the access provider. 

1 35. The system of claim 20 wherein the access controlling component is 

2 structured and arranged to affect bandwidth for communications between the access 

3 requestor and the access provider. 

1 36. The system of claim 20 wherein the access controlling component is 

2 structured and arranged to reroute the access requestor. 

1 37. The system of claim 21 wherein: 

2 the receiving component is structured and arranged to receive more than one data 

3 packet; and 

4 the access controlling component is structured and arranged to deny access by the 

5 access requestor to the access provider when a number of payload portions that include the 

6 predetermined pattern exceed a configurable threshold number. 

1 38. The system of claim 37 wherein the access controlling component is 

2 structured and arranged to deny access by the access requestor to the access provider when a 

3 number of payload portions that include the predetermined pattern exceed a configurable 

4 threshold number during a configurable period of time. 
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1 39. A computer program stored on a computer readable medium or a propagated 

2 signal for securing an accessible computer system, comprising: 

3 a receiving code segment that causes the computer to receive a data packet that 

4 includes a payload portion and an attribute portion and is communicated between at least one 

5 access requestor and at least one access provider; 

6 a monitoring code segment that causes the computer to monitor at least the payload 

7 portion of the data packet received and includes a scanning code segment that causes the 

8 computer to scan the payload portion for at least one predetermined pattern; and 

9 an access controlling code segment that causes the computer to control access by the 

10 access requestor to the access provider when the payload portion is determined to include at 

1 1 least one predetermined pattern. 

1 40. The computer program of claim 39 wherein: 

2 the receiving code segment causes the computer to receive more than one data packet; 

3 and 

4 the monitoring code segment further includes a counting code segment that causes the 

5 computer to count the number of data packets having payload portions that include the 

6 predetermined pattern. 

1 41. The computer program of claim 39 wherein the monitoring code segment 

2 includes a scanning code segment that causes the computer to scan the payload portion while 

3 handling the data packet with a switch. 

1 42. The computer program of claim 41 wherein: 

2 the receiving code segment causes the computer to receive more than one data packet; 

3 and 

4 the monitoring code segment causes the computer to monitor only at least one data 

5 packet that is distinguished. 
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1 43 . The computer program of claim 39 wherein: 

2 the receiving code segment causes the computer to receive more than one data packet, 

3 the computer program further comprises a distinguishing code segment that causes 

4 the computer to distinguish at least one of the data packets from among the data packets 

5 received for additional processing, and 

6 the monitoring code segment causes the computer to monitor the payload portion of 

7 the at least one data packet distinguished. 

1 44. The computer program of claim 43 wherein the at least one data packet is 

2 distinguished based on an Internet address associated with the data packet. 

1 45 . The computer program of claim 3 9 wherein: 

2 the receiving code segment causes the computer to receive more than one data packet; 

3 and 

4 the monitoring code segment causes the computer to monitor all of the data packets 

5 received. 

1 46. The computer program of claim 39 wherein the access requestor is a client 

2 and the access provider is a host. 

1 47, The computer program of claim 46 wherein the data packet is monitored when 

2 communicated from the client to the host. 

1 48. The computer program of claim 46 wherein the data packet is monitored when 

2 communicated from the host to the client. 

1 49. The computer program of claim 46 wherein the predetermined pattern 

2 includes a login failure message communicated from the host to the client. 

1 50. The computer program of claim 39 wherein the data packet includes a token- 

2 based protocol packet. 

1 51. The computer program of claim 39 wherein the data packet includes a TCP 

2 packet. 
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1 52. The computer program of claim 39 wherein the data packet includes a PPP 

2 packet. 

1 53. The computer program of claim 39 wherein the access controlling code 

2 segment causes the computer to deny access by the access requestor to the access provider. 

1 54. The computer program of claim 39 wherein the access controlling code 

2 segment causes the computer to affect bandwidth for communications between the access 

3 requestor and the access provider. 

1 55. The computer program of claim 39 wherein the access controlling code 

2 segment causes the computer to reroute the access requestor. 

1 56. The computer program of claim 40 wherein: 

2 the receiving code segment causes the computer to receive more than one data packet; 

3 and 

4 the access controlling code segment causes the computer to deny access by the access 

5 requestor to the access provider when a number of payload portions that include the 

6 predetermined pattern exceed a configurable threshold number. 

1 57. The computer program of claim 56 wherein the access controlling code 

2 segment causes the computer to deny access by the access requestor to the access provider 

3 when a number of payload portions that include the predetermined pattern exceed a 

4 configurable threshold number during a configurable period of time. 
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